model.h

sspi_workbench

#pragma once

// free dynamically allocated output by calling free()
class Model {
public:
    typedef void (*ERR_FCN)(const wchar_t*, bool, DWORD);

    Model(bool bServer, ERR_FCN errFcn);
   ~Model();
   
    void chooseSpecificSSP(const wchar_t* pszSSP);
    void chooseSPNEGO(const wchar_t* pszSSPList);

    void chooseCredentials(const LUID* logonSessionLuid = 0);
    void chooseCredentials(const wchar_t* pszAuthority,
                           const wchar_t* pszPrincipal,
                           const wchar_t* pszPassword);

    void chooseContextRequirements(DWORD grfContextRequirements);

    void initializeSecurityContext(const wchar_t* pszServerPrincipalName,
                                   void* pvInputRxFromServer, DWORD cbInput,
                                   void** ppvOutputTxToServer, DWORD* pcbOutput,
                                   bool* pbContinueNeeded, ULONG* pgrfCtxAttrs);
    void acceptSecurityContext(void* pvInputRxFromClient, DWORD cbInput,
                               void** ppvOutputTxToClient, DWORD* pcbOutput,
                               bool* pbContinueNeeded, ULONG* pgrfCtxAttrs);
    void impersonate();
    void revert();
    bool signMessage(const void* pvMessage, DWORD cbMessage, DWORD nSeqNo,
                        void** ppvSignedMessage, DWORD* pcbSignedMessage);

    bool encryptMessage(const void* pvMessage, DWORD cbMessage, DWORD nSeqNo,
                        void** ppvSealedMessage, DWORD* pcbSealedMessage);
    
    bool verifySignature(const void* pvSignedMessage, DWORD cbSignedMessage, DWORD cbMessage, DWORD nSeqNo,
                        void** ppvMessage);
    
    bool decryptMessage(const void* pvSealedMessage, DWORD cbSealedMessage, DWORD cbMessage, DWORD nSeqNo,
                        void** ppvMessage);

    void enumSSPs(ULONG* pn, PSecPkgInfo* ppPkgInfo);
    void freeEnumData(PSecPkgInfo pPkgInfo);

private:
    void operator=(const Model&); // not impl
    void _err(const wchar_t* psz, bool bRecoverable = false, DWORD err = GetLastError()) {
        m_errFcn(psz, bRecoverable, err);
    }

    enum ModelStates {
        msChoosingSSP,
        msChoosingCredentials,
        msChoosingContextRequirements,
        msAuthenticating,
        msAuthnComplete,
    };

    enum CredentialMethod {
        cmNormal,
        cmLogonSessionID,
        cmExplicit,
    };

    enum {_maxCredentialStringSize = 256};
    const bool                  m_bServer;
    const ERR_FCN               m_errFcn;
    ModelStates                 m_state;
    CredentialMethod            m_credMethod;
    wchar_t                     m_szSSP[128];
    wchar_t                     m_szSSPList[256];
    wchar_t                     m_szAuthority[256];
    wchar_t                     m_szPrincipal[256];
    wchar_t                     m_szPassword[256];
    SEC_WINNT_AUTH_IDENTITY_EXW m_authIdentity;
    DWORD                       m_grfContextRequirements;
    HINSTANCE                   m_hdll;
    PSecurityFunctionTable      m_pSSPI;
    TimeStamp                   m_credExpiry;
    TimeStamp                   m_ctxExpiry;
    CredHandle                  m_hcred;
    CtxtHandle                  m_hctx;
    bool                        m_bCalledAcceptYet;
};